USN-897-1: MySQL vulnerabilities

Ubuntu Security Notice USN-897-1

mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

Ubuntu 9.10

Ubuntu 9.04

Ubuntu 8.10

Ubuntu 8.04 LTS

Ubuntu 6.06 LTS

Software description

mysql-dfsg-5.0

mysql-dfsg-5.1

Details

It was discovered that MySQL could be made to overwrite existing tablefiles in the data directory. An authenticated user could use the DATADIRECTORY and INDEX DIRECTORY options to possibly bypass privilege checks.This update alters table creation behaviour by disallowing the use of theMySQL data directory in DATA DIRECTORY and INDEX DIRECTORY options. Thisissue only affected Ubuntu 8.10. (CVE-2008-4098)

It was discovered that MySQL contained a cross-site scripting vulnerabilityin the command-line client when the --html option is enabled. An attackercould place arbitrary web script or html in a database cell, which wouldthen get placed in the html document output by the command-line tool. Thisissue only affected Ubuntu 6.06 LTS, 8.04 LTS, 8.10 and 9.04.(CVE-2008-4456)

It was discovered that MySQL could be made to overwrite existing tablefiles in the data directory. An authenticated user could use symlinkscombined with the DATA DIRECTORY and INDEX DIRECTORY options to possiblybypass privilege checks. This issue only affected Ubuntu 9.10.(CVE-2008-7247)

It was discovered that MySQL incorrectly handled errors when performingcertain SELECT statements, and did not preserve correct flags whenperforming statements that use the GeomFromWKB function. An authenticateduser could exploit this to make MySQL crash, causing a denial of service.(CVE-2009-4019)

It was discovered that MySQL incorrectly checked symlinks when using theDATA DIRECTORY and INDEX DIRECTORY options. A local user could use symlinksto create tables that pointed to tables known to be created at a latertime, bypassing access restrictions. (CVE-2009-4030)

It was discovered that MySQL contained a buffer overflow when parsingssl certificates. A remote attacker could send crafted requests and cause adenial of service or possibly execute arbitrary code. This issue did notaffect Ubuntu 6.06 LTS and the default compiler options for affectedreleases should reduce the vulnerability to a denial of service. In thedefault installation, attackers would also be isolated by the AppArmorMySQL profile. (CVE-2009-4484)

Update instructions

The problem can be corrected by updating your system to the following
package version: